Always use HTTPS for tracking and unsubscribe links in emails #53

Background

getSiteUrl() (utils/mail.ts:6) uses process.env.PROTOCOL || "https", so PROTOCOL=http makes the tracking pixel, click and unsubscribe links in sent emails plain HTTP.

Why it matters: Gmail and Yahoo expect the RFC 8058 one-click unsubscribe URL to be HTTPS. Clients and security gateways flag or rewrite http:// links, and they leak tokens in clear text.

Proposed fix

• Build email-facing URLs with a helper that always uses https in production, separate from the API's listen protocol.
• Warn or fail at startup if production is configured for http.

Acceptance criteria

• In production, every link SendLit inserts into an email is https://, whatever PROTOCOL is set to.
• A unit test covers it.